Privacy
Version 2026-09-06-privacy-v2 · last updated September 6, 2026
CardPicker helps you plan and manage Canadian credit cards. This notice explains what we collect, why we need it, and the choices you have.
What we collect
We collect your email address to create your account and send sign-in links. After you consent, we collect your province, income and credit-score ranges, whether you carry a balance or expect major borrowing, spending amounts and categories, goals, planned expenses, and the card history you enter. Applications, approval and closure dates, spending progress, and bonus outcomes you record are also saved. Income and credit scores are ranges; spending and expense amounts are the numbers you enter. Authentication records may include your IP address, browser details, and session dates. We never connect to your bank, run a credit check, or access your statements.
What we use it for
We use your information to assess whether new-card planning is appropriate, calculate recommendations, preserve your card history, and maintain the reminders you enable. We use aggregate account, onboarding, plan, and application counts to understand whether the service is useful, and operational records to detect stale offers, failed jobs, and delivery problems. We do not sell your information, build advertising profiles, or use your financial information to train models.
Who we share it with
Vercel hosts the application, our Postgres database provider stores account information, and Resend processes email delivery, including your email address and message contents. Those service providers receive the information needed to run the product. Public issuer pages may be processed by page-reading and extraction services to maintain the catalogue; your personal financial profile is not sent to those extraction services.
Where it lives
Information is stored in our production database and transmitted using encrypted connections. Service providers may process information outside Canada under their applicable terms and safeguards. We keep your account information while your account exists. Calendar URLs contain a private token; anyone with the URL can read its events. You can reset that URL in Settings.
Deleting your data
Settings → Delete account removes your account and its profile, card history, applications, plans, reminders, and consent records from the active application database. This cannot be undone. Provider backups, email delivery records, and security logs may retain copies under their retention schedules; deleting the account does not promise immediate erasure from every provider backup. Aggregate counts that do not identify you may remain.
Consent
Before you save financial information, we ask you to review this notice and explicitly consent. We record the policy version and date of that choice. A material policy update requires you to review and accept the new version before continuing to save financial information. You may decline and delete your account. Reminder emails can be disabled independently in Settings; sign-in links are necessary to access your account.
Questions
For support, corrections, access requests, or privacy questions, contact the CardPicker operator responsible for privacy at the addresses below. You may also contact the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information.
support@cardpicker.caprivacy@cardpicker.ca